creates a problem with getting the vendor to update to suit the examiner.
Examiners don't run your bank, you do. If you don't agree with the examiner, see if you can negotiate this into the gray zone and off the "findings" list. If that doesn't work, challenge the finding at your exit conference. If that doesn't work, your exam report will contain your regulatory agency's official view of the matter, not just one examiner's opinion. Then, you will have a basis to make this interpretation
your policy and you can notify the vendor accordingly.